U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

91–213 DTP 2003

S. HRG. 108–252

THE DARK SIDE OF A BRIGHT IDEA: COULD

PERSONAL AND NATIONAL SECURITY RISKS

COMPROMISE THE POTENTIAL OF PEER–TO–

PEER FILE–SHARING NETWORKS?

HEARING

BEFORE THE

COMMITTEE ON THE JUDICIARY 

UNITED STATES SENATE

ONE HUNDRED EIGHTH CONGRESS

FIRST SESSION

JUNE 17, 2003

Serial No. J–108–17

Printed for the use of the Committee on the Judiciary

(

(II)

COMMITTEE ON THE JUDICIARY 

ORRIN G. HATCH, Utah, Chairman 

CHARLES E. GRASSLEY, Iowa 

ARLEN SPECTER, Pennsylvania 

JON KYL, Arizona 

MIKE DEWINE, Ohio 

JEFF SESSIONS, Alabama 

LINDSEY O. GRAHAM, South Carolina 

LARRY E. CRAIG, Idaho 

SAXBY CHAMBLISS, Georgia 

JOHN CORNYN, Texas 

PATRICK J. LEAHY, Vermont 

EDWARD M. KENNEDY, Massachusetts 

JOSEPH R. BIDEN, JR., Delaware 

HERBERT KOHL, Wisconsin 

DIANNE FEINSTEIN, California 

RUSSELL D. FEINGOLD, Wisconsin 

CHARLES E. SCHUMER, New York 

RICHARD J. DURBIN, Illinois 

JOHN EDWARDS, North Carolina 

BRUCE ARTIM, Chief Counsel and Staff Director 

BRUCE A. COHEN, Democratic Chief Counsel and Staff Director 

(III)

C O N T E N T S 

STATEMENTS OF COMMITTEE MEMBERS 

Page

Hatch, Hon. Orrin G., a U.S. Senator from the State of Utah ............................ 7

Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont, prepared 

statement .............................................................................................................. 66

WITNESSES 

Davis, Hon. Tom, a Representative in Congress from the State of Virginia ...... 3

Feinstein, Hon. Dianne, a U.S. Senator from the State of California ................. 1

Good, Nathaniel S., Graduate Student, University of California, Berkeley 

School of Information Management Systems and Aaron Krekelberg, University of Minnesota, Office of Information Technology ......................................... 9

Morris, Alan, Executive Vice President, Sharman Networks, Limited, accompanied by Derek Broes, Executive Vice President of Worldwide Operations, 

Brilliant Digital Entertainment .......................................................................... 13

Murray, Chris, Legislative Counsel, Consumers Union ....................................... 14

Saaf, Randy, President Mediadefender, Inc. ......................................................... 11

Waxman, Hon. Henry A., a Representative in Congress from the State of 

California .............................................................................................................. 5

QUESTIONS AND ANSWERS 

Responses of Nathaniel Good and Aaron Krekelberg to questions submitted 

by Senator Leahy ................................................................................................. 24

Responses of Alan Morris to questions submitted by Senators Hatch, Biden 

and Leahy ............................................................................................................. 27

SUBMISSIONS FOR THE RECORD 

Broes, Derek, Executive Vice President of Worldwide Operations, Brilliant 

Digital Entertainment, prepared statement ...................................................... 48

Davis, Hon. Tom, a Representative in Congress from the State of Virginia, 

prepared statement .............................................................................................. 52

Feinstein, Hon. Dianne, a U.S. Senator from the State of California, prepared 

statement .............................................................................................................. 57

Good, Nathaniel S., Graduate Student, University of California, Berkeley 

School of Information Management Systems and Aaron Krekelberg, University of Minnesota, Office of Information Technology, prepared statement ..... 59

Morris, Alan, Executive Vice President, Sharman Networks, Limited, prepared statement ................................................................................................... 70

Murray, Chris, Legislative Counsel, Consumers Union, prepared statement .... 79

Saaf, Randy, President Mediadefender, Inc., prepared statement ...................... 88

Waxman, Hon. Henry A., a Representative in Congress from the State of 

California, prepared statement ........................................................................... 93

(1)

THE DARK SIDE OF A BRIGHT IDEA: COULD 

PERSONAL AND NATIONAL SECURITY RISKS 

COMPROMISE THE POTENTIAL OF PEER–

TO–PEER FILE–SHARING NETWORKS? 

TUESDAY, JUNE 17, 2003

UNITED STATES SENATE, COMMITTEE ON THE JUDICIARY, Washington, D.C. 

The committee met, pursuant to notice, at 2:08 p.m., in Room 

SD–226, Dirksen Senate Office Building, Hon. Orrin G. Hatch, 

Chairman of the Committee, presiding. 

Present: Senator Hatch. 

Chairman HATCH. Sorry I am just a bit late. I understand Senator Feinstein has another appointment, so we are going to take 

her first, even before I make opening remarks. It is good to have 

you here, Tom, as well. We will take your statement first, too, after 

Senator Feinstein. 

STATEMENT OF HON. DIANNE FEINSTEIN, A U.S. SENATOR 

FROM THE STATE OF CALIFORNIA 

Senator FEINSTEIN. Thanks very much, Mr. Chairman. I Chair a 

Senate Cancer Coalition and we have got a very interesting meeting that starts just about now to begin. But I feel very strongly 

about this issue, so I very much appreciate an opportunity to testify. 

This hearing is on peer-to-peer networks and security risks. Now, 

peer-to-peer software is a technology that allows Internet users 

around the world to share files with each other very easily. All you 

need is some software, which can be obtained free, and an Internet 

connection, and your files are instantly made available over the 

Internet. This technology can be used to help researchers share information or files seamlessly across borders or to help business people share documents. In other words, there are good, positive, legitimate reasons for this. 

But as with many new technologies, there are also serious risks. 

One such risk is the recent explosion of illegally shared copyrighted 

files over the Internet, most of it occurring through these relatively 

anonymous peer-to-peer networks. Using this free software, one 

Internet user can simply put his or her entire music collection onto 

a computer and then open that computer up to the entire rest of 

the world, allowing anyone else with an Internet connection and 

similar software to find the music, to download it onto their own 

2

computers, and to listen to it at will without compensating the 

copyright holder, something that we have spent a lot of time on. 

Meanwhile, these peer-to-peer networks are also facilitating a 

new era of easily obtainable pornographic material, including child 

pornography. MediaDefender, a company that will testify today, 

has estimated that more than 800 universities are hosting child 

pornography on their networks. 

Of most concern, however, is the use of peer-to-peer file sharing 

by government employees. According to recent studies, the vast 

majority of peer-to-peer users have no idea of the breadth and 

scope of data they are sharing with users. A Federal employee intending to simply download and share music files, therefore, could 

easily make available every file on his or her computer, without intending to do so or even realizing it after the fact. This could include personal correspondence, private financial information, and 

even proprietary and sensitive government documents. 

For normal users, this lack of security presents the real threat 

of identity theft. Stored credit card information, financial documents of all kinds, personal information, like birthdays, mother’s 

maiden names, you name it, all of this is often stored on an individual’s computer and all of it can thus be compromised if the user 

is not careful when setting up peer-to-peer software. 

For government users, the situation is far worse. Not only personally sensitive information can be stolen, but information vital to 

the functioning of government, as well. Confidential memos, Defense Department information, law enforcement records, all could 

be available to any Internet user with some free software and the 

desire to go looking. 

The scope of the problem is unclear. Nobody really knows how 

many government employees are using this software and what 

level of risk there truly is. But one thing seems clear. The risk is 

not worth it. 

According to recent reports, it appears that many government 

employees are indeed using time at work to set up peer-to-peer 

software on government computers. They search for, they obtain 

pornographic data of all kinds. That is illegally downloaded and 

distributed, copyright material, as well. Each of these activities reduces work productivity. Many of these violate the law. And most 

importantly, the entire process opens those computers and computer systems to invasion by outside entities. 

The House and the Senate have already prohibited the use of 

this technology on Congressional computers, as I understand it, for 

these reasons. I am in the process of preparing a letter to the Cabinet heads of each Secretary asking them to look into this problem 

and work toward addressing it within each of their organizations, 

and I would like to give this to you. Perhaps you and others on the 

Committee might wish to either take it over or sign onto it at your 

pleasure. 

But there can be no doubt that the widespread use of these new 

technologies represents a grave security risk to this nation and 

should be treated as such. 

So, Mr. Chairman, this should be a very interesting hearing. I 

am sorry that I can’t stay. I am very interested in the topic and 

3

look forward as a member of the Committee working with you and 

see what we can come up with. 

Chairman HATCH. Thank you, Senator Feinstein. We appreciate 

your hard work on this Committee and your interest in this subject, so we will let you go so you can keep your appointments. 

Senator FEINSTEIN. Thanks very much. 

Chairman HATCH. Thank you. 

[The prepared statement of Senator Feinstein appears as a submission for the record.] 

Chairman HATCH. Representative Davis, we are honored to have 

you come over from the House. We welcome your testimony. 

STATEMENT OF HON. TOM DAVIS, A REPRESENTATIVE IN 

CONGRESS FROM THE STATE OF VIRGINIA 

Representative DAVIS. Thank you very much. As you know, we 

have held hearings on the House side and look forward to working 

with you on what can be done about this important issue. 

I associate myself with Senator Feinstein’s remarks. I agree with 

what she said. 

As you know, our Committee on Government Reform, which I 

Chair, has been investigating some of the risks associated with the 

use of these programs. File sharing programs are Internet applications that allow users to download and directly share electronic 

files from other users who are on the same network. These programs are easily installed and permit the sharing of files containing documents, music, or videos, free of charge. 

Now, file sharing is surging in popularity. The most popular file 

sharing program, Kazaa, has been downloaded almost 240 million 

times, making it the most popular software program downloaded 

from the Internet. File sharing programs are increasingly popular 

with kids. Research has shown that more than 40 percent of those 

who download files from peer-to-peer networks are under the age 

of 18. 

The technology underlying file sharing programs is not inherently bad, and it may turn out to have a variety of beneficial applications. However, as our Committee has learned, this technology 

can create serious risks for users. 

Most of the news coverage on file sharing focuses on one issue, 

the ability of users to trade copyrighted music, movies, and videos. 

Our Committee is investigating other aspects of file sharing. In 

March, we began our investigation by holding a hearing to examine 

the extent to which pornography, including child pornography, is 

traded on these networks. Last month, we held a second hearing 

to review the personal privacy and computer security risks posed 

by the use of these programs. 

At our first hearing, we learned that peer-to-peer networks have 

become an increasingly popular mechanism for trafficking in pornography, including child pornography. In fact, it seems as if many 

of these programs have become digital pornographic libraries where 

all sorts of pornographic materials can be easily accessed for free. 

At the Committee’s request, the GAO searched file sharing programs and found hundreds of pornographic images, more than half 

of which was child pornography and graphic adult pornography. 

Research performed by another witness at our hearing found that 

4

nearly six million pornographic files were available for downloading 

on one popular peer-to-peer network over a two-day period. 

These findings are very disturbing. Many of these pornographic 

images are appearing on our children’s computer screens whether 

they ask for it or not. Innocent searches for files using the names 

of popular cartoon characters, singers, and actors produce thousands of graphic pornographic images, including child pornography. 

At the hearing, we issued a report detailing our findings and I 

would urge parents to review it in order to become familiar with 

these issues. We also developed a list of non-technical actions parents can take to reduce or eliminate their children’s exposure to 

pornography on these networks. This list is available on the Committee’s website. 

Last month, we held a second hearing to examine threats to personal privacy and computer security posed by the use of file sharing programs. Despite the surging popularity of these programs, 

few people recognize the risks that this technology presents. For 

example, through a couple of simple searches on one file sharing 

program, Committee staff easily obtained completed tax returns 

with Social Security numbers, including the names and Social Security numbers of spouses and dependents; medical records; confidential legal documents, such as attorney-client communications 

regarding divorce proceedings and custody disputes; business files, 

including contract and personnel evaluations; political records, including campaign documents and private correspondence with constituents; and resumes with addresses, contact information, job histories, salary requirements, and references. 

There are several possible causes for the sharing of personal information over these networks. Users could accidentally share this 

information because of incorrect program configuration. We learned 

at our hearing that the installation and set-up process can be confusing and can cause users to unwittingly expose their entire hard 

drive. 

Unintentional sharing of personal information can also result 

from the sharing of one computer among several users. For example, a teenager sharing a computer with his or her parents may 

elect to make all the contents of the computer available for sharing 

without thinking about the types of files stored on the computer. 

Users may also intentionally share these files because increased 

file sharing earns the user higher priority status, resulting in faster downloads of popular files. 

Either way, the public should be aware that these programs 

could result in the sharing of personal information which can open 

the door to identity theft, consumer fraud, or other unwanted uses 

of their personal data. Parents, businesses, and government agencies also need to be aware of these risks if file sharing programs 

are installed on their office and home computers. 

And finally, another privacy concern raised by peer-to-peer sharing is bundling of these programs with software known as 

‘‘spyware’’ and ‘‘adware.’’ These programs monitor Internet usage 

primarily for marketing purposes, often without the user’s knowledge. They also give rise to pop-up advertisements and spam email. 

5

Finally, computer viruses can easily spread through file sharing 

programs, since files are shared anonymously. 

I commend this Committee for looking at these important issues. 

Computer users at all levels of expertise must understand and appreciate the risks associated with the use of this technology. Because of the privacy and security risks, users must fully understand which files are being shared. File sharing companies must 

also play a role in helping to protect personal privacy and make the 

programs safe for use by kids. At a minimum, instructions for installing and configuring these programs should be easy to understand and should be designed with the least technologically savvy 

user in mind. 

Once again, thank you for allowing me to testify. 

Chairman HATCH. Thank you, Representative Davis. We are 

happy to have you here on this side of the Hill and happy to have 

that testimony. We will excuse you if you need to get back. 

Representative DAVIS. I will wait for Mr. Waxman for five minutes and then we will walk over. 

[The prepared statement of Representative Davis appears as a 

submission for the record.] 

Chairman HATCH. All right. I will turn to my friend, Henry Waxman, as well. Good to see you, Henry. 

Representative WAXMAN. Thank you very much, Mr. Chairman. 

Chairman HATCH. We just had a hearing this morning on HatchWaxman or Waxman-Hatch. I know it depends on which side of the 

Hill. 

[Laughter.] 

Chairman HATCH. I was honored to work with you on that as we 

have on so many health care issues and I look forward to hearing 

your testimony on this. 

STATEMENT OF HON. HENRY A. WAXMAN, A REPRESENTATIVE 

IN CONGRESS FROM THE STATE OF CALIFORNIA 

Representative WAXMAN. Thank you very much, Mr. Chairman. 

I was honored to work with you on that legislation and we did a 

lot of good in the days when we were working together on health 

issues. 

But I come to you today to talk about another issue where I hope 

we can work together, if we could find some solution, legislative solution, to a problem that is really quite perplexing, and that is 

what happens when there are peer-to-peer networks and file sharing programs. Chairman Davis and I have worked closely together 

to bring attention to this technology and the questions it raises. 

This technology is in many ways a bright idea, as you indicated 

in the title of the hearing. It is a unique and innovative use of 

Internet technology. But it also carries significant risks that most 

people don’t know about. These programs are incredibly popular 

with young people. They have been downloaded literally hundreds 

of millions of times, and for teenagers and people in their 20s, peerto-peer file sharing programs are as common as a computer application as e-mail and word processing programs are for the rest of 

us. 

But my concern is that there is a digital generation gap when it 

comes to understanding these programs. Parents simply don’t have 

6

the knowledge about these programs that their children do, and as 

a result, many parents are unaware of the special risks posed by 

these programs. How many parents realize that these programs, if 

carelessly installed, can make every single bit of electronic information on a family computer available to millions of strangers? Very 

few. 

The Committee’s first investigation into peer-to-peer technology 

looked at one of the risks posed by file sharing programs, the prevalence of pornography. We learned that these peer-to-peer networks operate like a vast library of free pornographic content. Any 

child that has access to a broad-band connection can easily find 

and download the most hard-core triple–X videos imaginable in just 

a matter of minutes at absolutely no cost. They are pushed, this 

is all pornography is pushed on kids who may be looking for 

Britney Spears or some other popular artist. 

GAO reported at our hearing that kids are bombarded with this 

pornography even if they are not looking for it. We feel that parents need to be aware of this so they can talk to their kids and be 

advised that their kids may be having this kind of junk forced on 

them. 

Peer-to-peer programs connect users from anywhere in the world 

into a vast open, free trade network, where with the click of a 

mouse, users can share files back and forth with other users across 

the globe. 

Our staffs installed Kazaa—it is the most popular file sharing 

program—and ran test searches to see what kind of information 

people were sharing unintentionally, and what we found was amazing. We found complicated tax returns, medical records, and even 

entire e-mail in-boxes through simple searches using file share programs. We also found that other incredibly private documents, such 

as attorney-client correspondence relating to divorce proceedings 

and living wills, were also available. We found that tax returns and 

other private information could be downloaded by somebody who 

was using the file sharing at the same time. 

We prepared a report on our findings and I would like to submit 

it to you, Mr. Chairman, for your record and be included in this 

hearing. 

Chairman HATCH. Thank you. We will include it. 

Representative WAXMAN. I welcome the interest of your Committee in exploring this new technology. There is much this hearing and future ones can add to our understanding of file sharing 

programs. We need to work together on this issue. It has become 

a vehicle for pornographers, for intruders, for new technology that 

can lead to greater education. There are ups and down sides to this 

new technology and we need to figure out what is a rational approach to dealing with the down sides to it. 

Thank you very much. 

Chairman HATCH. Thank you very much. I am very impressed 

that you two friends would come over here and help us to understand this better, so we appreciate you being here. 

Representative WAXMAN. Thank you very much. 

Chairman HATCH. Thanks. 

[The prepared statement of Representative Waxman appears as 

a submission for the record.] 

7

STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM 

THE STATE OF UTAH 

Chairman HATCH. We will excuse both of you and let you get 

back to your busy lives. Thank you for coming. 

Our second panel includes four witnesses from the private sector 

who have taken leading roles in identifying and resolving the security concerns associated with peer-to-peer networks. 

Last year, Nathaniel Good and Aaron Krekelberg published a 

ground-breaking study entitled, ‘‘Usability and Privacy: A Study of 

Kazaa P2P File Sharing.’’

Our next witness will be Randy Saaf, the President of 

MediaDefender, Inc., a leading provider of computer security services to private and governmental entities. 

Next, we will hear testimony from Alan Morris, the Executive 

Vice President of Sharman Networks, Limited, the company that 

owns and operates the Kazaa peer-to-peer file sharing program. 

Mr. Morris is joined by Mr. Derek Broes, the Senior Vice President 

and Assistant General Counsel of Brilliant Digital Entertainment, 

the parent company of Altnet, the North American business partner of Sharman Networks. Altnet has provided a written statement 

for the record and Mr. Broes may assist Mr. Morris in responding 

to any questions relating to the activities of Altnet. 

And finally, we will hear testimony from Mr. Chris Murray, Legislative Counsel for Consumers Union. 

I want to thank you all for being here today and welcome you 

all here, but I think what I am going to do is first make my opening statement and then turn to you, in that order. We will start 

with Mr. Good and Mr. Krekelberg and then go across the way. 

We are here today to explore some potentially troubling aspects 

of an exciting technology that rightfully has gained the attention 

and admiration of millions and millions of Americans, and many 

millions more around the world, peer-to-peer file sharing networks. 

Recent developments in peer-to-peer networks have added dramatically to their versatility and, therefore, their utility to many computer users. 

Napster, the first peer-to-peer system, permitted the sharing of 

audio files only, but newer generations of this technology permit 

the sharing of all types of computer files, including audio files, 

video files, visual images, documents of all kinds, and computer 

programs. These advances have been accompanied by a soaring increase in the use of peer-to-peer networks. 

Kazaa, the most popular of these networks, is now the most popular download on the ‘‘downloads.com’’ Internet site. Kazaa and 

other file sharing programs have now been downloaded over 400 

million times. Kazaa often has over four million users connected to 

its network simultaneously. 

The demand for other popular P2P programs such as Grokster 

and Morpheus is growing rapidly, as well, and mostly among minors. Research shows that about 41 percent of those who download 

files over P2P file sharing networks are between the ages of 12 and 

18. These statistics underscore the great appeal and promise of 

P2P networks as well as the potential scale of any problems that 

they create. They permit rapid and broad dissemination of information and ideas and they have provided a powerful tool to researchVerDate 0ct 09 2002 11:00 Jan 15, 2004 Jkt 091213 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\91213.TXT SJUD4 PsN: CMORC
8

ers, hobbyists, and interested citizens seeking information and 

ideas on a wide array of topics. 

At the same time, however, they have also opened up our homes, 

our businesses, and our governmental agencies to potentially serious security risks that are neither widely recognized nor easily 

remedied. Recent studies involving some of the more popular P2P 

networks suggest that a significant number of their users are inadvertently sharing personal and highly-sensitive data over these networks, including tax returns, bank account information, personal 

identifying information, passwords, and e-mail in-boxes. 

While the true scope of this problem is still unknown, studies 

have shown that potentially malicious parties are searching P2P 

networks for personal e-mails and credit card numbers. This alone 

is disturbing, but in government agencies, employees’ use of P2P 

networks could also disclose sensitive government data to the enemies of this country. At this moment in history, the implications 

of this risk or the risks involved are trembling, to say the least. 

I am also troubled that many P2P networks require their users 

to install so-called ‘‘spyware’’ or ‘‘adware,’’ programs that monitor, 

collect, and record information about the Internet browsing habits 

of a particular user. Such programs can collect and disseminate information about the Internet use and personal information of anyone using the computer on which a P2P networking program has 

been installed. The invasion of privacy and potential for identity 

theft inherent in such programs has already attracted justifiable 

attention from members of Congress and consumer advocates concerned about the privacy and security implications of such practices. 

In addition, some of the spyware or adware programs can also 

wreak havoc on a user’s computer by commandeering their browsers, creating conflicts with other software that can crash a user’s 

computer and otherwise interfering with users’ control over their 

own computers. 

Finally, the users of P2P file sharing networks may also encounter malicious programs, such as viruses, worms, and trojan horses 

that have been disguised as popular media files. Indeed, the operators of the most popular file sharing program recently explained to 

the House Committee on Government Reform that ‘‘when files 

come from anonymous and uncertified sources, the risk of those 

files containing a virus greatly increases.’’

If the promoters of these networks acknowledge that their nature 

increases users’ risks of exposure to malicious programs, then they 

must also recognize their increased duty to protect and educate 

their users. 

I do believe that peer-to-peer file sharing networks are here to 

stay, but the problems of data privacy, spyware and viruses should 

remind all of us that the final role of peer-to-peer file sharing networks in our culture remains to be seen. 

This technology has great promise, but also some potential pitfalls. If these networks are designed to minimize the risks of file 

sharing, then the promises of this technology can become reality. 

If not, then users, network administrators, and others may ultimately conclude that the risks of this technology outweigh its advantages. 

9

I would like to thank all of our witnesses for appearing here 

today to address these important issues. We are particularly privileged to have with us three of our colleagues whose stellar work 

in this area has shed much needed light on the significance of the 

risks, as they have mentioned in their statements, and we appreciate that. They talked about their potential consequences, as well. 

So I was happy to have Senator Feinstein and Congressmen Tom 

Davis and Henry Waxman here with us today. 

So we are delighted to have all of you here today. We will start 

with you, Mr. Good and Mr. Krekelberg, and you just take over. We 

are going to give you only five minutes apiece, so I hope you can 

all stay within that time frame. 

Mr. GOOD. We will try. Thank you, Mr. Chairman. 

Chairman HATCH. We will try and be liberal in the use of time. 

STATEMENT OF NATHANIEL S. GOOD AND AARON 

KREKELBERG, AUTHORS OF ‘‘USABILITY AND PRIVACY: A 

STUDY OF KAZAA P2P FILE SHARING’’

Mr. GOOD. Good afternoon, Mr. Chairman. Thank you for the opportunity to appear before you here today. In the brief amount of 

time that we have, we would like to look at a study that we performed on a peer-to-peer file sharing program called Kazaa. In this 

study, we will discuss how configuration problems could contribute 

to users of P2P networks inadvertently sharing their personal and 

private information. 

In this study, we addressed two major issues. One issue is that 

users of P2P systems don’t always realize what they are sharing 

with others on the P2P network. In other words, sometimes people 

may think they are sharing one thing, but they are actually sharing something completely different. 

The second issue is that the kind of problem we have discovered 

is a problem with the program’s usability and the interaction between the application and the user. It is different than other problems that are frequently mentioned in the media because it is 

something that can’t be patched in a traditional sense that requires 

a redesign of the program’s way of interacting with the user, as 

well as educating the user to the potential problems that could 

occur. 

We felt that the file sharing on P2P systems could be secure and 

usable if users were made clearly aware of what files others can 

download, that they are able to determine how to share and stop 

sharing files, that the system does not allow users to make dangerous errors that lead to unintentionally sharing private files, and 

that users are comfortable with what is being shared and confident 

that the system is handling it correctly. 

By looking at the interface and performing a user study, we were 

able to determine that certain parts of the Kazaa application could 

be confusing to users and relied heavily on unstated assumptions. 

In some cases, it was possible for the user to think that what they 

were sharing was completely different than what was actually 

being shared. 

There are too many details to cover in the time that we have allocated, but a majority of the details are in our research paper and 

written testimony. 

10

On the screen in front of you is Kazaa. Kazaa is the most popular P2P file sharing program on the Internet today. With Kazaa, 

you can look at any type of file, such as music, documents, videos. 

Anything that can be stored on your hard drive can be shared or 

downloaded from others. To do this, one would download the application and type the keywords that one is looking for into the search 

box. Kazaa then returns the search results to the window to the 

right of the search screen. Users can download other files or see 

files from other users. 

In any peer-to-peer system, the user has to make two important 

configuration choices. They have to decide where they are going to 

store files that they download from the network and what files they 

are going to share with others. In most peer-to-peer systems, the 

folder that one chooses to save the files to is also the one that is 

shared with other users. In addition, all files and folders contained 

in that location are also typically shared. 

So in the next couple of slides, we will be describing some points 

of confusion that may cause people to share more than they realize 

and possibly share private information. Again, there are many 

more details that we could go over, but due to the brevity of this 

testimony, we will just go over some of the most important ones 

and focus in on one of the worst-case scenarios. 

The first problem we will describe is when users specify the location they would like to store downloaded information to. The problem here is with terminology. There is no indication that these files 

and folders will also be shared, as well as all files and folders contained in whatever folder you specify. There is also no description 

of the types of file types that can be shared. In addition, this is the 

only location where users can disallow sharing with other users. 

Another problem that we discovered was with the Search Wizard 

and the folder list, which were two interfaces that were designed 

to allow people to specify what they could share with the Kazaa application, and in some cases, Kazaa will bring this up when the 

user is first running the installation for the program. 

In the search interface, Kazaa will look through the user’s computer and determine what sort of files that they could share with 

the network. In this case, it came back with ‘‘My Documents’’ file 

and thought that there would be something good to share there. 

Unfortunately, it doesn’t tell me what it is going to share there and 

relies on my assumptions of what Kazaa can do in order to share 

these programs with other people. 

In the next interface is a list for browsing the computer hard 

drive and its contents and users can check off what area they 

would like to search, or they would like to share with other users. 

In addition, there is the ‘‘My Shared’’ folder, which is the default 

folder that things can be shared in, is checked all the time. 

The problem in both of these interfaces is that there is no association between what is indicated as shared in the file import and 

what is indicated as shared in the downloaded folders. So unless 

users intuitively know that these two are linked, there is no way 

for them to know that the download folder is also the sharing folder. 

While this chance is rare, the confusion that may arise from this 

problem could confuse users for other situations, as well. In a 1996 

11

USENIX conference, Matt Bished, a prominent security expert, 

mentioned that configuration errors are a probable cause for more 

than 90 percent of security failures. Education of users is one 

means of helping to reduce configuration errors. In addition, providing help and explanations can sometimes be useful, but has limitations. Users rarely read documentation and frequently gloss over 

privacy statements and textual explanations embedded in the 

interface. 

We feel that the issues we describe would be most adequately addressed at the application level, where they would be most effective. Thank you very much for your time. 

Chairman HATCH. Thank you. We appreciate it. 

[The prepared statement of Mr. Good and Mr. Krekelberg appears as a submission for the record.] 

Chairman HATCH. Mr. Saaf, we will turn to you. 

STATEMENT OF RANDY SAAF, PRESIDENT, MEDIADEFENDER, 

INC. 

Mr. SAAF. I would like to thank you for holding this hearing and 

inviting me to speak. My name is Randy Saaf and I am the President of MediaDefender. MediaDefender is one of the most well-respected peer-to-peer anti-piracy software companies in the world. 

We have very sophisticated tools for understanding piracy problems 

on the peer-to-peer network and security problems and we want to 

share these tools with this Committee. 

Usually, only very sophisticated computer users get involved 

with network and software. In the case of peer-to-peer networking, 

that is simply not true. The sheer quantity of users of peer-to-peer 

networking mean that quite a few really don’t know that they are 

opening their computers up to the whole world. 

In the summer of 2000, Napster was hitting its stride as the hottest software application in the world. Napster really didn’t have 

very many security problems. It had roughly 40 million users, but 

it was mainly used to share MP3 pirated music files. Today, the 

peer-to-peer networks have over 80 million users and they are used 

to trade all sorts of rich media files, including documents and software applications. 

All the security concerns associated with peer-to-peer networking 

come from the file sharing aspect common to every program. If a 

user never changes the default settings in a program like Kazaa, 

they probably won’t have any security problems. The problem is 

that with the sheer number of users, you are always going to have 

a certain segment that just want to change the settings or don’t understand the settings. Many users of peer-to-peer do not realize 

that the default folder that they download content to is shared up 

to the entire peer-to-peer network. 

A typical scenario of a security risk might be a child who 

downloads his music files to his parents’ ‘‘My Documents’’ folder 

that contains all their personal tax and financial information, and 

that folder then gets re-shared to the entire network. 

MediaDefender collected data from the sixth to the ninth of this 

month. We were invited to participate in this hearing on the fifth, 

so we only had a few days to collect data, but we wanted to get 

something that was a representative sampling of a security risk. So 

12

MediaDefender looked for Microsoft Money files shared on the Fast 

Track-based Kazaa network. 

Microsoft Money files are personal tax and financial information 

and there is really no reason somebody would want to be sharing 

those on a peer-to-peer network. MediaDefender found 8,034 

unique Microsoft Money files being shared on the Fast Track-based 

network on 6,032 unique IP addresses. The larger implication is 

that probably almost every one of those people were sharing their 

entire ‘‘My Documents’’ folder on Kazaa because that is where the 

Microsoft Money file gets saved by default. 

So I want to give a brief demo that I did at 12:00 this afternoon 

at Kinko’s, where I just plugged my laptop in and did a search for 

‘‘.mny.’’ I search ‘‘.mny,’’ click enter, and up comes a screen full of 

Microsoft Money files, and you will notice each one of them has the 

Microsoft Money extension. I just randomly selected one and did 

the feature of ‘‘find more from the same user.’’ Now, this is a pretty 

standard feature in Kazaa. Anybody could do this at home. This is 

no fancy software involved in this. 

Clicking ‘‘find more from the same user’’ brought up 1,500 files 

that that person has shared on their computer, I mean, presumably 

in their ‘‘My Documents’’ folder, and you can look at the files. They 

are just a hodgepodge of different types of files, including pictures, 

private pictures, phone-type information. Obviously, their Microsoft 

Money file was in there, which presumably contains all their financial information. 

A user could then select all those files and just click ‘‘download’’ 

and have that person’s entire snapshot of that person’s life. I mean, 

I can see from the screen here the person goes to Indiana University and there is probably a whole lot of information you can tell 

about this person in this relatively quick exercise that took approximately five minutes. 

So you can see how the clear extension of this problem could be 

carried over to businesses and government organizations, because 

for the same reason people don’t understand they are sharing documents at home that they don’t intend to, people at government organizations will do the same. People want to download their music 

and movies on their fast Internet connections at work. 

So for this particular study, we looked for as many computers we 

could find with the search phrases ‘‘Madonna,’’ ‘‘The Matrix,’’ 

‘‘porn,’’ and ‘‘sex.’’ We pretty much arbitrarily chose those search 

phrases because we knew they would give us a lot of returns, and 

I don’t think any files with these words in them would have any 

legitimate governmental purposes. 

We focused on three government organizations, Los Alamos National Laboratory, NASA, and the Naval Warfare Systems Command. We chose them because they are obviously sensitive organizations that would have sensitive data. We found 155 computers at 

Los Alamos National Laboratory sharing files on peer-to-peer networks, 138 computers at NASA, and 236 at the Naval Warfare Systems Command. I am fairly sure that these are unintentional sharing, because I don’t think anybody in these organizations would be 

intentionally sharing pornography files and those types of things 

on a peer-to-peer network at work. 

13

This was not a comprehensive study. We simply wanted to demonstrate there was a problem and we would recommend to the 

Committee that further studies be done to actually quantify the extent of the problem. Thank you. 

Chairman HATCH. And you just did that at Kinko’s today? 

Mr. SAAF. Pardon? 

Chairman HATCH. You just did some of this at Kinko’s today? 

Mr. SAAF. Yes. I did this part at Kinko’s today. It was pretty 

much a five-minute exercise, what I went through there. It is very 

fast. 

[The prepared statement of Mr. Saaf appears as a submission for 

the record.] 

Chairman HATCH. Mr. Morris? 

STATEMENT OF ALAN MORRIS, EXECUTIVE VICE PRESIDENT, 

SHARMAN NETWORKS, LIMITED; ACCOMPANIED BY DEREK 

BROES, EXECUTIVE VICE PRESIDENT OF WORLDWIDE OPERATIONS, BRILLIANT DIGITAL ENTERTAINMENT 

Mr. MORRIS. Thank you very much indeed, Chairman Hatch, for 

inviting us to come today and to help the Committee in its determinations about the very important issues of security and privacy 

in file sharing. 

I am the Executive Vice President of Sharman Networks, Limited. I look after the company’s business when Sydney is asleep, 

and importantly, I look after its licensed activities, along with my 

colleagues here at Altnet. And in that respect, we are the world’s 

largest distributor of licensed files. 

When we acquired the Kazaa Media Desktop, or Kazaa, as it is 

known, we set ourselves two goals. Firstly, to be the premier distributor of licensed files, and with over half-a-million licensed files 

distributed a day, I think we have achieved that; and secondly, to 

set the standards in usability. 

If I can talk first about viruses, an issue which is very important, 

we recognized this last year, and everybody knows the effect viruses can have. So we invested in a fully-featured anti-virus program called BullGuard, and BullGuard has been installed as an active part of the Kazaa Media Desktop for over a year now. So no 

user of the Kazaa Media Desktop need ever be bothered by viruses. 

It runs there and it is free. 

Secondly, inadvertent file sharing. Since we acquired the assets, 

we have carried out usability tests. We looked at the work that the 

guys, Good and Krekelberg, did back in April last year on Version 

1.7 and we have constantly modified the user interface, because it 

is important. It is crucial that people don’t inadvertently share 

files. The latest Version 2.5, which is in public beta at the moment, 

which I am going to send the guys for their comments, makes it 

very, very difficult, indeed, for somebody to inadvertently share 

files. 

We have used best industry practice, known as, A) make it intuitive, and B) most importantly, make it safe by default. So if anybody tries to share parts of their hard drive which would be inadvisable, they get a very strong notice, like ‘‘Do you want to do 

this?’’ So I will be very interested in what you guys think about 2.5. 

14

Thirdly, the issues of privacy. Issues have been raised such as 

spyware. We have got a very strict new spyware policy. We certainly serve advertising. We use proprietary ad serving technology 

and we have one application bundled which is used by many Fortune 100 companies, and very clearly by our definition it is not 

spyware. 

User education to us is fundamentally important. We accept that 

responsibility as the leader in the marketplace and we would distance ourselves, I think, from our competitors, if they don’t mind 

us saying that. So on the website, in very clear English, we give 

very clear guidance about how people can share safely. And again, 

guys, we welcome your views on that. We talk about issues like 

cookies and opt-ins. Spam has been mentioned. We have never 

spammed. We haven’t sent it ourselves. And we have never sold 

any e-mail addresses. 

The other issue that has been raised is that of pornography. We 

totally abhor child pornography. I am a parent myself. What we 

have is a fully password-protected adult filter. We can’t control 

what is distributed on the network. It is a digital democracy. But 

what we do is, by default, there is a series of filters for adult and 

offensive material which is password-protected and it is there to 

encourage and support responsible parenting. 

So we emphasize user education very strongly. The issue that we 

all face, I think for every application on the Internet, is the extent 

to which people, as has already been mentioned here, are prepared 

to accept that education. A recent AOL study on broadband use 

shows that many people choose not to update their anti-virus software. They choose not to use firewalls. So it does behoove us as the 

industry leader, and the rest of the industry, to work with the 

Committee and work with other agencies worldwide to ensure that 

user education is of the highest standard. 

It is particularly important, because in this always-on world, this 

wide world of broadband, the risks are much, much higher. It is 

well recognized, I think, that peer-to-peer is the main driver of 

broadband. It is the thing that drives the broadband future. 

So, Mr. Chairman, we are very happy to work with you, with 

members of the Committee and other agencies in the areas of improving the interface and in the areas of user education. 

Chairman HATCH. Well, I appreciate the comments and we will 

be happy to have you work with us and help us, if we can. 

[The prepared statement of Mr. Morris appears as a submission 

for the record.] 

Chairman HATCH. Let us turn to Mr. Murray and Mr. Broes. 

Mr. BROES. My statement has already been entered into the 

record. 

[The prepared statement of Mr. Broes appears as a submission 

for the record.] 

Chairman HATCH. Mr. Murray? 

STATEMENT OF CHRIS MURRAY, LEGISLATIVE COUNSEL, 

CONSUMERS UNION 

Mr. MURRAY. Chairman Hatch, I am both grateful and honored 

by your invitation to testify before the Committee today. Consumers Union, as publisher of Consumer Reports magazine, is an 

15

organization that makes its living based on intellectual property, 

based on compensation for our creation, as well as our reputation 

as based on the trust of consumers. 

Since the first issue of Consumer Reports arrived in consumers’ 

mailboxes in the 1930s, we have built our reputation, I think, on 

a love affair with technology and a desire to make that technology 

work better for consumers. Today’s hearing presents another opportunity to scrutinize a technology with both enormous potential and 

enormous problems. 

The potential comes in the form of some really exciting new applications that we see, such as peer-to-peer distributed computing. 

We have got—Oxford’s Center for Drug Discovery is using the 

power of peer-to-peer distributed computing to help come up with 

new drugs to solve problems like cancer and I believe they are also 

working on a cure for smallpox. 

We have Stanford’s ‘‘Folding at Home’’ project, where they are 

using normal consumers like you and me, they are using our computers to run protein folding sequences, things that just require 

enormous amounts of processing power that an average research 

university or library just wouldn’t have the funds to undertake. 

And we have got normal consumer uses of peer-to-peer technologies. There is a technology out there called Spam Watch right 

now where it is a collaborative filtering software whereby users 

flag a particular piece of e-mail as spam, and then when enough 

users flag that as spam, they say, okay, we are going to shut this 

person down to the rest of the network. 

But we also have seen today it comes with a dark side. As the 

Committee clearly understands, both the promise and potential as 

well as the dark side appear, and the dark side that we see and 

that we are concerned about is two-fold. Number one, the default 

settings concern us greatly because consumers are unwittingly 

sharing documents like tax returns, Social Security numbers, private information, money files, as we saw. But there is also this 

really prevalent use of spyware and adware that concerns us. 

I think one of the, if I can jump straight to my punch line, I 

think perhaps the most exciting near-term role I can see for Congress in this space is to do exactly what you are doing today, which 

is open this up to sunshine and make sure that people understand 

what exactly, what risks they are exposing their computers to. 

That seems to have had some effect. I guess in their latest build, 

they are saying that they have remedied some of these problems. 

I hope that we can continue to move the industry along with default settings, make sure that configurations work for consumers. 

As I dug into this a little bit in preparation for today’s hearing 

and I looked at where uses of spyware and adware are happening 

on peer-to-peer, I realized, number one, it is a rampant problem on 

peer-to-peer and I am quite concerned about it. But number two, 

perhaps of even greater concern is I discovered that this is all over 

the place on the Internet. Mainstream providers, such as Microsoft, 

AOL’s Netscape, Real Networks, have features on their software 

that millions upon millions of users are using whereby they are 

being tracked. Their music preferences, their reading preferences, 

their DVD watching preferences are being sent back to companies, 

in some cases along with a unique identifier which says, this is 

16

what this particular consumer is watching and reading and listening to. 

I think we, like you, are believers that if consumers can get information in their hands, they can begin to make some of the right 

decisions and we can move the marketplace along far. 

And so there are three things, if I can just summarize what I 

would like to say today very briefly, there are three roles that I 

think Congress can help play. 

Number one, education. Users of peer-to-peer systems need to be 

aware that what they are doing on their computers can expose 

them to enormous risks. Part of our education problem is that 

sometimes the users aren’t the same people that would be concerned about risks. If I am a parent, I don’t necessarily know that 

my child is going to be downloading Kazaa or Morpheus or 

Grokster or whatever application onto my system and potentially 

exposing my files to great risk, and so that this education process 

needs to extend not only to the people who are using the application, but to parents in general. 

The second role I see for Congress is investigation. I would be 

very grateful if the Chairman would urge the Federal Trade Commission to look into uses of spyware and adware in the marketplace. I see, again, in peer-to-peer, it is a rampant problem, but it 

is also a rampant problem in the mainstream software applications 

base. 

And the final role I see for Congress is in the policy arena. Sometimes, there is just no educating around a design problem. Perhaps 

the role that Congress could fill, the gap that Congress could fill 

would be to provide consumers with as much notice about what is 

going into the software that they are using on their computers. If 

there is spyware and adware that comes along with that software, 

we think that educating consumers—consumers can only be educated if they know exactly what is underneath the hood of that 

software. So perhaps we could discuss and work with the Committee on coming up with some solutions in that space. 

As I said before, I think any solutions we come up with in the 

peer-to-peer space are going to necessarily extend to the rest of the 

Internet because the fundamental architecture of the Internet is 

that of peer-to-peer. Anytime we try to regulate peer-to-peer as 

such, I think we are also talking about a very broad regulation of 

the Internet in general. It is difficult for me to imagine a definition 

of peer-to-peer that doesn’t also include applications such as e-mail 

and instant messaging. 

I am very grateful, as I said, Mr. Chairman, for the opportunity 

to testify here today and we would be happy to continue the conversation. 

Chairman HATCH. Thank you. We appreciate all your testimony. 

[The prepared statement of Mr. Murray appears as a submission 

for the record.] 

Chairman HATCH. Let me start with you, Mr. Morris. You make 

the point that parents or employers who own Internet-connected 

computers must educate themselves about the operation or design 

flaws of every peer-to-peer software program that might be 

downloaded by their children or employees and then reeducate 

17

themselves every time any one of these programs is updated or ordered. Is that one of the arguments you are making, that parents—

Mr. MORRIS. No, the argument I make is that, as the leader, we 

have a responsibility and we take that very seriously. So when people choose to download Kazaa Media Desktop in all the versions 

from 1.7 up until now, we have done our very best to make sure 

it is very clear to people what happens, make it very clear to parents exactly how the parental control filter works, and also make 

it very, very difficult for people to inadvertently file share. 

Now, we hope that sets a standard for other people and we hope 

that other peer-to-peer providers follow our lead, but we can’t, obviously, legislate for them. 

Chairman HATCH. No, but is it true that anti-virus software distributed with Kazaa is disabled by default when the software is installed? Is that true? 

Mr. MORRIS. No. It is currently enabled by default. 

Chairman HATCH. It is enabled? 

Mr. MORRIS. It was previously disabled. It was an optional choice 

for people. And now, in the latest version, it is currently enabled. 

Chairman HATCH. In your written testimony, you state that, 

‘‘Users control the material they choose to share with others.’’ This 

leads me to ask, does Sharman Networks accept any responsibility 

for the files that are shared inadvertently or even illegally over the 

Kazaa network? 

Mr. MORRIS. No. As I said, we have no control over what is the 

digital democracy, but we do do our very best to, firstly, when 

somebody downloads the Kazaa Media Desktop, they have a very 

clear end user license agreement. We like to believe it is written 

in plain English, unlike some. And that obliges them to state that 

they will not infringe copyrights. Now, we can’t police that. And all 

over the website, you’ll see statements like, ‘‘Do not infringe copyright.’’ And certainly with pornographic material, we have the parental control feature, but we cannot police the network. It is physically and technically impossible. 

Chairman HATCH. Mr. Good and Mr. Krekelberg, let me ask you 

this question. I would like to commend both of you for identifying 

the data security problems potentially associated with peer-to-peer 

file sharing. In your testimony, you state that these problems are 

not intrinsic to peer-to-peer technology, but derive from the design 

of the Kazaa program. Now, do you know whether any similar 

problems affect other file sharing programs? 

Mr. GOOD. As stated earlier when we were giving our demonstration, all peer-to-peer file sharing systems have to do two things. 

They have to say what you are going to save and where you are 

going to save it to, and also what you are going to share. So any 

peer-to-peer file application, you have to address those problems 

somehow in the interface, and so not only with Kazaa, but other 

peer-to-peer file sharing programs, you have the same sort of issues 

that would arise. 

Chairman HATCH. Do you have anything to add, Mr. Krekelberg? 

Mr. KREKELBERG. The point we were trying to make with that 

statement is that peer-to-peer technology is not fundamentally 

flawed where people will just start sharing all their stuff. There 

are some user interface issues that need to be addressed with most 

18

of these peer-to-peer clients, that users accidentally share things 

they don’t want to share. 

Mr. GOOD. In addition, we have looked at some other peer-topeer file sharing programs and they seem to have similar sort of 

issues that Kazaa would have. 

Chairman HATCH. I am going to submit for the record written 

testimony from the Business Software Association. 

But let me ask you, Mr. Saaf, how often are peer-to-peer networks updated or altered to circumvent firewalls, filters, and other 

security measures that computer owners might take to protect 

themselves from the risks that are outlined by your testimony here 

today? I mean, who makes these alterations and why are they 

done? 

Mr. SAAF. Well, peer-to-peer file sharing networks are frequently 

updated. I am not sure that they are really updated to circumvent 

anything per se. Sometimes, they may be. That is really—I would 

have no idea. I do think that a fundamental issue with the peerto-peer networking is that you are going to have to get rid of some 

of the cool things about the peer-to-peer networking to take care 

of a lot of fundamental problems, like child pornography and security. 

The bottom line is, if you leave a peer-to-peer network wide open 

for anything to be shared, you are always going to run a risk that 

people are going to share the wrong stuff. So it is going to be this 

tension of give and take, and I think eventually the peer-to-peer 

networks may have to give up some of the cooler functionality if 

they are going to seriously take care of the piracy and child pornography and security concerns. 

Chairman HATCH. In your experience, how many peer-to-peer 

sharing programs install spyware and adware programs? 

Mr. SAAF. I mean, most of them. They need to make money to 

pay their staff. Typically, it is free software, so there has to be 

some method of getting revenue. But like was stated in other people’s testimony, that is not totally uncommon on the Internet. A lot 

of software does have spyware and adware. 

And again, you know, if you don’t have as much money to pay 

programmers to develop cool peer-to-peer applications, then the applications won’t be as cool. So if you get rid of the spyware, then 

all of the sudden the company doesn’t have the money to develop 

the peer-to-peer applications. It is going to be always a tension. 

Chairman HATCH. What can these programs do to their host 

computers? 

Mr. SAAF. What can they do? 

Chairman HATCH. Yes. 

Mr. SAAF. You mean in terms of damaging those computers? 

Well, the problem with any sort of spyware or adware or really any 

sort of software that is unregulated or not operated by a big company is it is not always necessarily designed perfectly, and what 

could end up happening is two or three spyware or adware programs just conflict with each other. You might have a spyware that 

gets installed with one version of a peer-to-peer networking software and a spyware that gets installed with another version of a 

different peer-to-peer networking software and those two spywares 

just don’t know how to be graceful with each other, whereas you 

19

are not going to run into those same sort of problems with, like, 

Microsoft Word and Microsoft Power Point, because those are very 

well designed programs that have millions of dollars of development in them. 

Chairman HATCH. Mr. Murray, do you have anything to add here 

or what we might do in Congress besides what you said in your testimony? 

Mr. MURRAY. Well, that is an excellent question, Senator. Perhaps I could briefly add Consumer Reports’ recommendations to 

users as to what we can do in general to protect ourselves, a couple 

quick things. 

Number one, you should have some form of virus software installed in your computer and you should update that at least weekly. If possible, we recommend for users, especially anybody that has 

a broadband connection, because a persistent broadband connection 

presents a lot of the same risks that peer-to-peer does, you can be 

quite transparent to the world with some very simple hacking 

tools—

Chairman HATCH. So every time it comes up on the screen, you 

ought to click onto it. 

Mr. MURRAY. The updated—

Chairman HATCH. Yes. 

Mr. MURRAY. As annoying as it is, yes, Senator, I believe that is 

the right answer. You should go ahead and say, yes, update my 

files, at least weekly is what we recommend. But for broadband 

users especially, we recommend putting in place a firewall, which 

can either be a piece of software or actually a physical router with 

a firewall which goes behind your modem. That can go a long ways 

towards making your computer opaque to the rest of the world. 

If users are going to use peer-to-peer software, we also recommend that they download it from one of the major portals. One 

of the bigger problems that we are having is that a piece of software such as Kazaa’s Media Desktop, there are all of these thirdparty sites out there which say, hey, if you come to me and pay 

me a dollar, I will let you have Kazaa, when they, in fact, have 

nothing to do with Kazaa, and some of the worst forms of spyware 

and adware that we have seen have to do with these third-party 

distributors. So we recommend, again, a lot of what goes on in 

these networks is illegal sharing of intellectual property. So we are 

not meaning to endorse that in any way, but insofar as there are 

legitimate uses of these networks, you should download it from a 

major portal. 

Chairman HATCH. I am going to put Senator Leahy’s statement 

in the record. He could not attend this hearing, but he wanted to. 

He takes great interest in these matters, so I will put his statement in the record immediately following my statement. 

Let me just ask one last question. I have heard that with regard 

to piracy problems and the stealing of music and copyrighted material, that there is now a software or at least a methodology of giving a warning that what you are doing is an illegal act, giving another warning, and then finally just destroying their computer. Are 

you aware of that, the warning that we are going to destroy your 

computer if you keep doing this illegal act? Can somebody help me 

to understand that? 

20

Mr. MORRIS. Derek is one of the foremost experts on security 

issues in P2P, so I think I would ask Derek to answer. 

Chairman HATCH. I have been wanting to ask you a question, so 

this is a good one for you. 

Mr. BROES. First, I should explain my role in this is that Brilliant Digital and Altnet, we are the commercial component to 

Kazaa Media Desktop. All of the media that we distribute through 

the network is licensed commercial material, including 30,000 independent artists. 

And so our major concern, obviously, is with copyright. In being 

the largest distributor of digitally rights managed material, we 

have learned that distributing DRM-ed content is working. We distribute, as Alan mentioned earlier, 500,000 digital rights licenses 

every single day, and that is growing. 

So as far as educating the user is the most critical piece, and as 

you mentioned, putting up a banner that says what they are doing 

is illegal is something that we have encouraged in the click wrap 

agreement with Kazaa Media Desktop, and that is precisely what 

they do, is warn them that they are in violation of this agreement. 

To inhibit the usability of the application at this stage simply 

pushes users into a deeper, darker tunnel of using peer-to-peer networks. For instance, if they would get very, very frustrated with a 

specific way, they are going to flee to some networks that are highly encrypted, such as FreeNet. They are going to find ways. They 

are going to use anonymizers to disguise themselves. 

So the issue here and our feeling is that gradually changing user 

behavior is the approach to this, and that is critical, and this goes 

to as far as the user education. For instance, today, I have my 

laptop, which is wireless, and I picked up on a number of wireless 

networks from a number of companies within the D.C. area, including law firms, where files were accidentally being shared via—in 

fact, their entire network is accidentally being shared via wireless 

networks. And these are IT folks that are in charge of these. 

This is not a problem that is just localized to P2P networks. This 

is with technology altogether. We need to take greater care in educating ourselves and practicing—and as a company leading this initiative, we have to practice best practices, and we feel that we lead 

that, particularly because we are making this a commercial initiative. 

Chairman HATCH. That has been very helpful, but—

Mr. SAAF. I would like to address that question, as well, if you 

wouldn’t mind. 

Chairman HATCH. Can you destroy their set in a home? 

Mr. SAAF. Yes. I think that is not something anybody is really 

interested in doing. 

Chairman HATCH. Well, I am. I am interested in doing that. 

[Laughter.] 

Chairman HATCH. I am very interested. That may be the only 

way you can teach somebody about copyright. 

Mr. SAAF. What the industry, speaking as an anti-piracy software company, what the industry is mostly interested in is noninvasive solutions to the piracy problem. Nobody wants to destroy 

files. Nobody wants to go onto people’s computers and damage 

those computers. 

21

Chairman HATCH. But you can? There is methodology you could 

do that? 

Mr. SAAF. I am not really aware of anybody that is exploring 

methodology in a legitimate way to actually destroy people’s computers. It is just not something that anybody is really interested in 

doing. 

What people are interested in doing is non-invasive anti-piracy 

measures, such as what our company does, is decoying, where we 

just put fake files on the network. It is extremely non-invasive. It 

just tries to create a needle-in-a-haystack situation, where the pirated content is difficult to find. 

The bottom line is that it is not the 30,000 independent artists 

that are being pirated, it is the top 100 platinum artists that are 

being pirated on these networks and it is crucial that that be protected on these networks. 

But in terms of invasive procedures, nobody is—I am not aware 

of anybody that is really pursuing invasive technology. 

Chairman HATCH. Okay. 

Mr. MURRAY. Senator, if I can perhaps try and respond. I am not 

the biggest technology expert on the panel by any means. My understanding is that there are viruses out there that could have the 

effect of doing what you are describing there, and if a company that 

were enforcing copyrights chose to use such means, they would 

have such means available. 

Chairman HATCH. Well, I would think that in order to do that, 

you would have to have a law passed by Congress enabling them 

to do that. I mean, there are a lot of other issues involved there, 

but I was interested that there is technology available. You could 

actually warn the person, warn them again, and tell them, ‘‘if you 

continue, we are going to destroy your machine.’’ I was interested 

in that because that would be maybe the ultimate way of making 

sure that no more copyright is pirated. But—

Mr. MURRAY. That does seem to be what Representative Berman’s bill contemplates. 

Chairman HATCH. Pardon? 

Mr. MURRAY. Insofar as I understand it, that seems to be what 

Representative Berman’s bill in the House contemplates, is that 

sort of action. 

Mr. SAAF. I would take issue with that and disagree with that. 

As Representative Berman’s bill, our company is the primary company that bill was directed towards and the bill very clearly does 

not allow any sort of invasive procedures. It is a very—I recommend anybody actually look at the actual context of the bill before drawing conclusions. There are sensationalists, like it is directed towards hurting people’s computers. 

Invasive procedures are not being pursued by any legitimate 

anti-piracy software company right now. That is just a fact. 

Mr. BROES. Well, I can add a piece to that. I was the CEO prior 

to being at Altnet, was the CEO of Vidius, which was actually the 

company that was hired by the RIAA and the MPAA to do the evaluation of the Fast Track network prior to the lawsuit that was 

filed. We practiced and we developed technology that was considered interdiction. In fact, we were one of the first, I think even before MediaDefender. We did spoofing. 

22

What we found it to be is actually very ineffective, not cost—it 

is not cost effective at all. It actually cost us more to interdict and 

to spoof than it was worth, than the progress that we were making, 

for the reason that the peer-to-peer networks are a democracy. 

When you spoof a file and you put it out there, the intent is to try 

to seed the network with millions of these spoofed files, and what 

happens is users, once they find out that that file is a spoofed file, 

they remove it out of their shared folder. So they are no longer 

sharing that folder, which means that the company is now faced 

with the burden of seeding the network once again with that same 

spoofed file. That costs money and bandwidth. 

Our approach to this has always been a positive, kind of a glass 

is half-empty, half-full. If this glass here represents all of the pirated content on the Internet or all of the pirated content on peer-topeer network, if we took a gallon jug of milk and we filled that full 

of legitimate content, then I kept pouring that into that network, 

eventually, it is going to be filled with milk and not water. 

So my point is that if we continue to take digitally rights managed files, which is a positive approach curbing user behavior, we 

will find that users find it more difficult to find the pirated content 

and the viruses and everything else because we have populated the 

network with legitimate content that is available for a price. 

So I have practiced personally as a company and as the CEO of 

a company the tactics that you are speaking of and I can tell you 

that it actually makes the problem more difficult. 

Chairman HATCH. That is interesting. Well, we would like you to 

consider helping us to understand what are the best methodologies 

that we can use or what would be the best thing Congress could 

do to help to avoid and prevent piracy of copyrighted materials 

throughout the country and the world. Write to us and help us to 

understand this better, because there is no excuse for anybody violating the copyright laws. Those laws are what protect our artists 

and our novelists and you name it, anybody who can qualify for a 

copyright, in what they are trying to do. And if they get a copyright, that ought to be respected. 

And if we can find some ways to do this short of destroying their 

machines, I would like to know what it is. But if that is the only 

way, then I am all for destroying their machines and letting them 

know. 

[Laughter.] 

Chairman HATCH. After you have a few hundred thousand of 

those, I think people will grow up and realize. But we would have 

to pass legislation permitting that, it seems to me, before somebody 

could really do that with any degree of assurance that they are 

doing something that might be proper. 

I am very interested in this area, and naturally, we have had everybody in the entertainment world come to us and say, ‘‘Please, 

help us to find a way around these piracy situations because it is 

just costing billions and billions of dollars.’’ I have seen first-run 

movies out within an hour after the movie is shown for the first 

time on a pirated basis. Of course, you can imagine what happens 

in the publishing world and the recording world. It is just awful. 

23

So we could use your help on that. Congress can’t do everything, 

but if there are some things we can do with regard to copyright, 

we would like to do them. 

This has been a very interesting panel. I really appreciate all of 

you coming and taking your time to help us to understand this better. I commend you for the success that you have made and for the 

great work that you are doing in the respective areas of the industry that you represent. So thank you for being here. 

With that, we will recess until further notice. 

[Whereupon, at 3:17 p.m., the Committee was adjourned.] 

Questions and answers and submissions for the record follow.]

24


91213.001
25


91213.002
26


91213.003
27


91213.004
28


91213.005
29


91213.006
30


91213.007
31


91213.008
32


91213.009
33


91213.010
34


91213.011
35


91213.012
36


91213.013
37


91213.014
38


91213.015
39


91213.016
40


91213.017
41


91213.018
42


91213.019
43


91213.020
44


91213.021
45


91213.022
46


91213.023
47


91213.024
48


91213.025
49


91213.026
50


91213.027
51


91213.028
52


91213.029
53


91213.030
54


91213.031
55


91213.032
56


91213.033
57


91213.034
58


91213.035
59


91213.036
60


91213.037
61


91213.038
62


91213.039
63


91213.040
64


91213.041
65


91213.042
66


91213.043
67


91213.044
68


91213.045
69


91213.046
70


91213.047
71


91213.048
72


91213.049
73


91213.050
74


91213.051
75


91213.052
76


91213.053
77


91213.054
78


91213.055
79


91213.056
80


91213.057
81


91213.058
82


91213.059
83


91213.060
84


91213.061
85


91213.062
86


91213.063
87


91213.064
88


91213.065
89


91213.066
90


91213.067
91


91213.068
92


91213.069
93


91213.070
94

Æ


91213.071